Server-Side Request Forgery Vulnerability in Apache XML Graphics Batik
CVE-2026-49236

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Xml Graphics Batik
Vendor
CVE Published:
11 November 2026

What is CVE-2026-49236?

A Server-Side Request Forgery (SSRF) vulnerability exists in Apache XML Graphics Batik that can be exploited through the SVG color-profile xml:base attribute, allowing it to bypass the same-origin checks for external resources. Users are strongly advised to upgrade to version 1.20, where this issue has been addressed to ensure better security and integrity of applications utilizing this library.

Affected Version(s)

Apache XML Graphics Batik 0 <= 1.19.0

References

https://issues.apache.org/jira/browse/BATIK-1394
issue-tracking
https://lists.apache.org/thread.html/xpysqx09ycpj23qk6b10...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.